CVE-2026-16968

The GeoDirectory WordPress plugin prior to version 2.8.168 is vulnerable due to inadequate access controls on its user-search functionality, permitting any authenticated user with Contributor-level access or higher to access the email addresses of all registered users, including administrators. This exposure could lead to privacy breaches and targeted phishing attacks. WordPress site administrators and security teams should prioritize this vulnerability to protect user data and maintain compliance with data protection regulations.